What a PDF password actually protects
The PDF format has two kinds of password, and they work very differently.
- The open password (also called the user password) encrypts the file. Every page, image and piece of text is scrambled with a key derived from the password, and without it the content is unreadable noise. This is real protection, as strong as the password itself.
- The owner password (also called the permissions password) is meant to control what someone who has opened the file may do: print, copy text, edit, fill forms. These limits are only flags inside the file. Well-behaved readers respect them, but nothing technically stops software from ignoring them.
This tool always sets an open password, so the file cannot be read without it. It does not switch off printing, copying or editing: anyone who knows the open password can use the document normally. The optional owner password is stored as the file's master password, which editors such as Acrobat ask for when someone tries to change its security settings. If you leave it empty, the open password fills both roles.
How the encryption is done
The file is processed by qpdf, a widely used open-source PDF toolkit, compiled to run inside your browser. It encrypts with AES-256, the strongest method the PDF standard defines, supported since Acrobat X in 2010 and part of PDF 2.0. Every current desktop and mobile reader supports it. The only places it occasionally fails are very old software, such as outdated document-management systems, older multifunction printers that print PDFs directly from a USB stick, or reader versions from before 2010.
You can protect several files in one go; each gets the same password and is saved with "-protected" added to its name. The browser path accepts files up to 100 MB. For larger files the page offers server processing, where the file and the password are sent to our server for that one job; the job and its files are deleted about an hour after it was created.
Choosing a password that holds
AES-256 itself is not the weak point. Someone who obtains the file can, however, try passwords offline as fast as their hardware allows, with no lockout after failed attempts. The password is the only thing standing in the way, so its length and randomness decide how long the file stays private.
- A short word or a date of birth can fall to a dictionary or date list within seconds or minutes.
- Eight random lowercase letters give about 200 billion combinations, which is within reach of a determined attacker with fast hardware.
- Four or five random words, or 14 or more mixed characters, put the file out of practical reach.
Password generator creates suitable passwords in the browser.
Two habits matter as much as strength. First, send the password through a different channel from the file: the PDF by email, the password by text message or phone call. A password in the same email as the attachment protects nothing. Second, store the password somewhere safe. There is no recovery: if it is lost, so is access to the document.
Order of operations
Encrypted PDFs cannot be opened by most editing tools without the password, including the ones on this site. Do everything else first and protect last:
- Merge, reorder or delete pages.
- Add a watermark, page numbers or a drawn signature.
- Compress the file if it needs to fit an email limit; Compress PDF cannot process a file that is already encrypted.
- Protect it as the final step.
If the source PDF already has an open password, remove it with Unlock PDF before adding a new one. Keep an unprotected original in a safe place too, so later edits do not require unlocking every time.
One more detail: encrypting rewrites the file. If the PDF carries a digital certificate signature, for example a contract signed through an e-signature service, protecting it afterwards breaks the signature's integrity check. Leave such documents as they are and share them through the service that signed them.
Privacy
On the browser path, the file and both passwords stay on your device: the encryption runs in the page itself, nothing is sent to a server, and the passwords are not stored anywhere after you close the tab. The protected copy is created in memory and handed to you as a download.